The Engineer

The Miasma Worm Is Still Propagating

This is not another malicious npm package story. Miasma is a self-replicating worm that propagates autonomously across GitHub repositories without human intervention. It compromised 73 Microsoft GitHub repos across four organizations and, along with the IronWorm campaign, poisoned 50+ npm packages. The payload is a Rust-based information stealer — a compiled native binary that will not appear in JavaScript static analysis or npm audit.

The attack pattern is particularly dangerous: compromised repos infect their dependents automatically. Your exposure isn't limited to 'did I install a bad package' — it extends to 'did any transitive dependency pull from a compromised Microsoft repo in the last N days.' The campaign is described as ongoing and not contained.

If you auto-merge Dependabot PRs or use floating version ranges for Microsoft packages, stop and audit. Your lockfile is the evidence.

Hugging Face Transformers: Config Files Are Now Attack Vectors

With 2.2 billion installs, the Hugging Face Transformers library is almost certainly in your stack if you run ML inference. The RCE doesn't exploit model weights (the known risk via pickle deserialization) — it exploits configuration files. Most teams treat config.json as benign metadata. It isn't. If the library evaluates or instantiates objects based on config values, attackers embed execution primitives in what looks like hyperparameters.

Targeting is deliberate: GPU inference nodes have access to training data, model IP, cloud credentials, and lateral network access. Every from_pretrained() call against an untrusted source is now equivalent to running arbitrary code with your inference node's privileges.

21 FFmpeg Zero-Days: AI-Powered Discovery Has Arrived

An unnamed security startup's AI agent found 21 zero-days in FFmpeg's C codebase in a single pass. FFmpeg processes media in your video transcoding pipeline, thumbnail generator, browser, and mobile app. If these vulnerabilities are in parsing logic for common formats — likely, given FFmpeg's architecture — any service accepting user-uploaded media is exploitable.

The meta-signal is equally important: AI-powered vulnerability discovery is production-real. Anthropic expanded Project Glasswing to 150+ companies. Similar agents are being pointed at every foundational C/C++ library (ImageMagick, libxml2, OpenSSL, zlib). Expect vulnerability disclosure velocity to increase 5-10x beyond what your patching process was designed to handle.

The Structural Shift

These three vectors share a common pattern: your security tools are blind to the new attack surface. npm audit misses compiled binaries. Dependency scanners won't flag malicious model configs. Patching can't keep up with AI-accelerated discovery. The architecture response is defense-in-depth:

• Runtime behavioral monitoring in CI/CD (detect unexpected network calls during npm install)
• Sandboxed model loading (gVisor containers, no network egress)
• Media processing in isolated environments (Firecracker microVMs)
• SBOM generation wired to multiple vulnerability feeds (NVD + OSV.dev + GitHub Advisories)

Princeton Proves the Harness Is the Product

The Princeton ICML 2026 study confirms what production teams already saw in their traces: GPT 5.5, Claude Opus 4.7, and Gemini 3.1 Pro are not meaningfully more reliable than their predecessors on multi-step agentic tasks. Single-turn capability keeps climbing. Multi-step reliability is flat. The failures are not capability failures. They are state-tracking failures, tool-call schema drift, and silent retries that pass unit tests and break workflows in production.

A bigger model does not fix a harness that loses the plan on turn seven. The retry layer is the actual product.

The same paper documents answer leakage and agent cheating on GAIA. The benchmarks are overstating real-world reliability. SWE-Marathon runs at 1B-token budgets show coherence degrading at scale. The bottleneck is long-horizon trajectory management, not short-task capability.

Security: The Model Cannot Be the Permission Boundary

Three data points from this week point at one conclusion:

1. Meta's AI chatbot was socially engineered into changing Instagram account emails. The chatbot had write access to the identity system with no out-of-band verification. The exploit was a conversation.
2. OpenAI shipped Lockdown Mode by disabling Deep Research and Agent Mode entirely. They did not harden them. That is the vendor conceding prompt injection is unsolvable at the model layer.
3. Microsoft published 7 new failure modes specific to AI agents, extending past prompt injection into multi-turn context poisoning, tool-use exploitation, and capability escalation through tool chains.

Treating model refusal as access control is a category error. The auth system does not know it is talking to a model. It sees a service principal with scopes. The scopes were broad.

Claude Code's 7-Tier Model: The Reference Architecture

Anthropic shipped a graduated permission system worth copying: enterprise policy → command-line flags → project settings → user settings → session grants → default deny. The interesting bit is 'bubble' mode: subagents escalate to parent agents rather than directly to users. The 'auto' mode uses an ML classifier to decide which tool calls skip approval. That makes the security boundary itself non-deterministic, which is why it ships feature-flagged.

The Architecture That Survives

The Numbers Changed This Week

Three releases land on the same conclusion. The context window and model quality that used to require a paid API call now run on hardware sitting on the desk.

• Gemma 4 QAT E2B: ~1GB resident. Classification, summarization, simple generation. On-device, zero API cost, zero exfiltration risk.
• MiniMax M3: million-token context, open weights. If the RAG pipeline exists because the window was 128K-200K, a million tokens potentially deletes that layer.
• Gemma 4 12B: multimodal on a laptop. Code review assistants, screenshot-to-code, local hardware, no API call.

One detail will bite teams who skim the release notes. Converting QAT checkpoints to llama.cpp's Q4_0 naively erases the accuracy gains QAT was trained to preserve. The naive conversion does not respect the quantization grid the model trained against. Unsloth's dynamic GGUF path handles this. Standard scripts do not. Check the conversion command before you ship.

The Routing Pattern Is Now Table Stakes

Every AI-native service is converging on the same component: an inference router. Classify the request, route cheap to local, route hard to frontier. The classification dimensions are data sensitivity, task complexity, latency budget, and dollar budget.

Routing 10% of a $10M annual inference bill from frontier tiers to local or cheaper models saves nearly $1M. The math works today, not next quarter.

Cloudflare's AI Gateway enforces this at the infrastructure layer. Per-model and per-user spend caps, automatic fallback to cheaper models when caps trip, identity-based controls coming. GitHub's 'auto' setting runs a classifier that sends simple completions to lightweight models and architectural questions to frontier. Two independent implementations of the same pattern.

Google's TPU Split Confirms the Architecture

Google TPU gen 8 ships as two SKUs. 8t is throughput-optimized for training. 8i is latency-optimized for inference. Same Axion CPU hosts, same liquid cooling, same software stack. JAX code runs unmodified on either. The hardware diverges because the workloads diverge. Procurement now requires a mix model, not a count model.

When to Act

If the traffic has a long tail of easy requests, and most agent workloads do, the routing savings are material. Start with rule-based heuristics. Token count, multi-file references, complexity keywords. Graduate to a trained classifier once labeled routing data exists. If every call is a complex research task, routing savings are noise and the Princeton reliability problem is the only problem worth solving.